fix(knowledge): refresh unchanged mirrored ACLs without firing the projection fan-out

[waleedlatif1]

Summary

• Admin-mode (mirrored ACL) syncs rewrote acl on every listed document every page, even when unchanged. The document trigger copies acl onto every chunk's search projection rows, and a projection row the backfill hasn't filled yet (acl IS NULL) is distinct from every ACL — so each unchanged document still rewrote all its chunks, each one a vector index insert. One ACL batch could outrun the 60 s statement timeout (SQLSTATE 57014) and fail the whole sync right after the permission fetch
• persistDocumentAcls now splits each ACL group into two statements: rows whose acl and acl_requirements already match only get acl_verified_at refreshed (no acl in the SET list, so the trigger never fires); only rows that actually differ get the ACL write
• Changed ACL writes go in batches of 25 instead of 500, since their cost scales with the chunks of every document in the statement, not the document count
• Evidence semantics are unchanged: unchanged ACLs still get a fresh acl_verified_at, the unresolved-duplicate guard applies to both statements, and a row is counted once (refresh runs first)

Type of Change

• Bug fix

Testing

• New sync-persistence.postgres.test.ts against real Postgres with the projection trigger installed: an unchanged ACL leaves unfilled projection rows untouched and refreshes evidence; a changed ACL still propagates to filled and unfilled rows; a changed restriction under the same primary ACL counts as a change; a mixed page writes each document once
• Mutation-checked: reverting the fix fails 2/4, dropping the restriction comparison fails 1/4, dropping the changed-row guard fails 2/4, swapping statement order fails 2/4
• Updated mocked sync-persistence.test.ts; lib/knowledge/access, lib/knowledge/connectors, connectors/google-drive suites pass with Postgres (1206 tests)
• bun run lint, bun run check:audits (47), docs-manifest:check, type-check pass

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docs	Ready	Preview	Sep 22, 2026 10:29pm UTC

[cubic-dev-ai]

No issues found across 3 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Re-trigger cubic}

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge; the follow-up changes add effective regression coverage without introducing a new actionable issue.

Summary

This PR avoids projection fan-out when mirrored document ACLs have not changed while preserving evidence refresh semantics.

• Separates unchanged-row evidence refreshes from changed ACL writes.
• Reduces changed-ACL batches to account for per-document chunk projection work.
• Adds real-PostgreSQL coverage for unchanged, changed, restricted, mixed, batched, and unresolved ACL cases.
• Adds the PostgreSQL regression suite to CI.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Group documents by desired ACL state] --> B{Stored ACL and requirements match?}
  B -->|Yes| C[Refresh acl_verified_at only]
  B -->|No| D[Write ACL, requirements, and evidence]
  C --> E[No projection trigger fan-out]
  D --> F[Document trigger updates chunk projections]
  E --> G[Count updated document once]
  F --> G

Loading

_{Reviews (2) · Last reviewed commit: "test(knowledge): run the ACL write Postg..."}

[waleedlatif1]

@greptile

[waleedlatif1]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

No issues found across 4 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Re-trigger cubic}